A while ago I tried one of those online voice-cloning demos, the kind that asks for a short sample and hands you back a synthetic twin. I fed it a few seconds of my own voice, typed a sentence I had never said, and pressed play. What came back was not perfect. It did not need to be. It was me enough to fool anyone who loves me, and it took less time than making a coffee.
The research says my little experiment was not a fluke. Microsoft’s VALL-E paper showed personalized speech synthesis from a three-second sample, and McAfee researchers produced an 85 percent voice match from three seconds of audio using freely available tools, 95 percent with a bit more training data. Meanwhile the classic scam this enables, a cloned voice of a relative pleading for emergency money, is documented by both the FTC and the FBI. The raw material for it is everywhere, in every voicemail, every story, every video posted anywhere.
My first instinct was the same as everyone’s. We need better deepfake detectors. And that instinct is a trap. Detection is an arms race against generators that improve every month, and the detector has to win every single time, in real time, on a phone call. So flip the problem. Stop trying to detect the fake. Prove the real.
ENCODE packages that flip. You get a personal, portable call-identity you share like a handle, a trust list of people whose devices have mutually verified each other, and a badge on every call that tells you, at a glance, which world the caller is calling from. It does not analyze anyone’s voice. It answers a smaller, harder question with certainty: is this call coming from the device I already trust?
Market & Opportunities
The money at stake is not hypothetical. Americans reported losing 3.5 billion dollars to imposter scams in 2025 alone, up from 2.95 billion in 2024, according to FTC Consumer Sentinel data, and reported losses understate reality since most fraud never gets reported. On the corporate side, business email compromise, the “fake CEO” family of fraud, cost victims roughly 3 billion dollars in reported losses in 2025 per the FBI’s IC3 report, with more than 20 billion accumulated since 2015. Voice cloning is pouring fuel on both fires.
The detail that convinced me this idea deserves to exist is that the FBI already tells people to build ENCODE by hand. Its December 2024 public service announcement on AI-enabled fraud advises, verbatim, “Create a secret word or phrase with your family to verify their identity.” The federal answer to billion-dollar AI fraud is, literally, a family password. It is good advice, and it is also fragile. People forget the word, say it on a compromised line, or panic and skip it just when it matters. When the official mitigation is a manual ritual, there is room for a product that makes the ritual automatic.
The two markets stack naturally. Families are the story: the grandparent who gets the 2am call, the parent who wired money because the voice was crying. Companies are the engine. An ENCODE directory bound to the corporate identity provider, so that a video call from “the CFO” carries a verified badge or it does not, is a line item any security budget understands.
What already exists, and why it is not enough
I have to name the graveyard first, because pieces of this idea are everywhere. Signal’s safety numbers already let two people verify their channel cryptographically. Signal itself notes this verifies the keys, not the human behind the account, and the feature is optional and buried. Even the automatic key verification Signal added in August 2026 has to be started by hand, contact by contact. STIR/SHAKEN, mandated by the FCC, lets carriers attest that a call really comes from the number displayed. It authenticates the number, not the voice, and the attestation is stripped whenever a call crosses legacy non-IP networks. And the family code word, as we saw, has a federal endorsement and a human failure rate.
So the invention here is not cryptographic novelty. Every brick exists. The product is the assembly and the defaults: verification that happens without anyone comparing sixty-digit numbers, a badge that is simply there on every call, and a system that fails loudly instead of silently. Signal built the engine and hid it in a settings menu. ENCODE’s bet is that the entire product is the part Signal considered optional.
Key Features
- A portable call-identity. Your ENCODE ID is a short handle you give out like an email address, on a business card, a LinkedIn profile, an email signature. Anyone can request to add you; nothing happens until you approve.
- A mutually verified trust list. Approval runs device-to-device: both phones exchange keys, and from then on each can prove it is talking to the other. No central server holds the relationship graph.
- Four levels, not two. Verified contacts ring green. Honest strangers, the delivery driver, the hospital, ring yellow: unverified, flagged, but never blocked. Calls with spoofing markers get challenged. Only manifest fraud gets cut. A binary system would break real life; a graded one degrades gracefully.
- A badge that stays on. Verification is not a checkmark at pickup; it is a persistent indicator during the call. If the cryptographic session breaks mid-conversation, the badge goes red while you are still talking. That is the moment that matters.
- Device changes as a security event. New phone means re-verification: a QR handshake from the old device when possible, and your contacts see “new device” on your next call until they re-confirm. The moment attackers love most, “hi, new phone, new number,” becomes the moment the system is loudest.
- An honest label on the tin. The app states plainly what it proves and what it does not, which brings us to the next section.
What ENCODE does not do
ENCODE authenticates the device, not the person. It is a badge for your front door. It proves the badge is present, not that the right hand is holding it. If someone steals your father’s unlocked phone, ENCODE will vouch for them. If someone coerces a person into calling you themselves, every light stays green, because the call is genuine even though the situation is not.
It also does not detect deepfakes, and it should never pretend to. Bolting a voice-analysis layer onto ENCODE would dilute the one promise it can keep into two promises it cannot. The right architecture is separation. ENCODE proves the channel, and if the detection arms race someday produces something reliable, it can run alongside. What ENCODE kills specifically is the scam that works today at scale: a stranger with thirty seconds of cloned audio and a spoofed number, calling cold. That attacker never held the trusted device, so they never get the green badge, no matter how perfect the voice is.
Monetization
Free for individuals and families, permanently, because a trust network with a paywall is a trust network nobody joins, and every additional verified family is marketing no budget could buy. The business is B2B: per-seat licensing for organizations, with the ENCODE directory synced to the identity provider (Okta, Microsoft Entra), admin policies like “wire transfers require a green-badge call,” and audit logs. Security teams already buy anti-BEC tooling measured in billions of losses; a verified-call layer for executives prices itself. A later tier can serve banks and brokerages that want to place verified outbound calls to clients, an inversion of today’s absurd ritual where the bank calls you and then asks you to prove who you are.
Next Steps: How I’d Build It
Phase one is app-to-app calling only, and that is a feature, not a compromise. Inside its own VoIP calls, ENCODE controls the whole experience end to end and depends on nobody’s favors. It needs no carrier cooperation and no deep hooks into the phone’s native dialer. Signal bootstrapped the same way. On iOS, CallKit already lets VoIP apps present calls in the native interface, which is enough for the green-badge experience within the app’s own calls.
There are two blockers. First, the platform ceiling. Deep integration with ordinary cellular calls is limited by what Apple and Google expose, so full protection of legacy phone calls is a vision that requires either OS-level adoption or carrier partnerships, and the article you are reading does not promise those. The strategy is to own the app-to-app layer so thoroughly that platform integration becomes the obvious next move for someone bigger. Second, the cold-start problem. A trust list is worthless alone. The wedge is the family unit, three to six people who install it in one sitting because one of them just read about a voice-clone scam, and the enterprise pilot, one finance team, one policy, one quarter of audit logs.
Build order: the identity and key-exchange core, the two-person verified call, the four-level badge UX, then the family circle, then the Entra/Okta sync. A working two-person prototype is a weekend of WebRTC plus a signal protocol library. The product is everything around it.
Closing
ENCODE refuses to play the detection game at all. Prove the real, label the rest, fail loudly. The FBI already told your family to do this with a whispered word. This just makes the word unforgettable, unphishable, and automatic. It belongs to the same fight as ThreatShield, my concept for a safer inbox. Both are tools for the people we love who did not grow up with this internet.
If you build this, tell me. I will be your first verified contact. And if you want to argue about the threat model before you write a line of code, even better; that conversation is the product.
